deploy.yml

name: Deploy

on:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: waynode-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26
          cache: npm

      - name: Install dependencies
        run: |
          npm ci
          npm --prefix frontend ci

      - name: Validate deployment files
        run: |
          find scripts .github/deploy -type f -name '*.sh' -exec bash -n {} +
          cp .env.example .env
          trap 'rm -f .env' EXIT
          docker compose -f docker-compose.yml config --quiet
          docker compose -f docker-compose.ffrapposerver.yml config --quiet
          node e2e/test-deploy-contract.mjs

      - name: Test and build
        run: |
          npm test
          npm run build:frontend

      - name: Build and inspect both runtime images
        run: |
          docker build --build-arg "WAYNODE_REVISION=${GITHUB_SHA}" -t waynode-ci .
          docker build --file sandbox/Dockerfile --build-arg "WAYNODE_REVISION=${GITHUB_SHA}" \
            --tag waynode-sandbox-ci .
          for image in waynode-ci waynode-sandbox-ci; do
            docker run --rm --entrypoint sh \
              --volume "$PWD/config/pi-components.json:/tmp/pi-components.json:ro" \
              --volume "$PWD/scripts/smoke-pi-components.mjs:/tmp/smoke-pi-components.mjs:ro" \
              "$image" -lc \
              'pi --version && lean-ctx --version && node /tmp/smoke-pi-components.mjs /tmp/pi-components.json'
          done
          docker run --rm --entrypoint node \
            --volume "$PWD/scripts/check-sandbox-image.mjs:/tmp/check-sandbox-image.mjs:ro" \
            waynode-sandbox-ci \
            /tmp/check-sandbox-image.mjs /root/.pi/agent/models.json

      - name: Package exact source revision
        run: git archive --format=tar.gz --output="${RUNNER_TEMP}/waynode-source.tar.gz" "${GITHUB_SHA}"

      - name: Install SSH key
        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}

      - name: Install pinned server host key
        env:
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          test -n "$DEPLOY_KNOWN_HOSTS"
          install -d -m 700 ~/.ssh
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts
          ssh-keygen -F "${{ secrets.DEPLOY_HOST }}" -f ~/.ssh/known_hosts >/dev/null

      - name: Stage exact source without touching production
        run: |
          stage="/var/tmp/waynode-deploy-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          ssh ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} \
            "install -d -m 700 '$stage'"
          scp "${RUNNER_TEMP}/waynode-source.tar.gz" \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:"$stage/source.tar.gz"

      - name: Reconcile, deploy, and publicly verify transaction
        run: |
          ssh ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} \
            "DEPLOY_SHA=${GITHUB_SHA} DEPLOY_ID=${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT} bash -se" <<'REMOTE'
          set -Eeuo pipefail
          stage="/var/tmp/waynode-deploy-${DEPLOY_ID}"
          source_dir="$stage/source"
          install -d -m 700 "$source_dir"
          tar -xzf "$stage/source.tar.gz" -C "$source_dir"
          exec env \
            LIVE_DIR=/opt/waynode \
            STAGED_ROOT="$stage" \
            STAGED_SOURCE_DIR="$source_dir" \
            DEPLOY_SHA="$DEPLOY_SHA" \
            DEPLOY_ID="$DEPLOY_ID" \
            ALLOW_LEGACY_SOURCE=1 \
            WAYNODE_CI_DEPLOY=1 \
            bash "$source_dir/.github/deploy/deploy-production.sh"
          REMOTE